19 May 2026 draft high-risk classification guidelines
The European Commission published draft guidelines on high-risk AI system classification on 19 May 2026. The draft supports Article 6 review across the Annex I product or safety-component route and the Annex III use-case route. The consultation closes on 23 June 2026. The draft may change before final adoption.
Open Commission draft guidelines
Route the system before you argue the answer.
High-risk classification starts with the route. Product-integrated AI, Annex III people-impact use cases, narrow Article 6(3) filter arguments, and incomplete vendor files require different evidence records.
Annex I product route
Use this path when the AI system is itself a regulated product or acts as a safety component of a regulated product requiring third-party conformity assessment.
Annex III use-case route
Use this path when the AI system falls into a listed Annex III area such as employment, education, essential services, biometrics, justice, migration, or law enforcement.
Article 6(3) filter route
Use this path only when an Annex III system may be narrow, preparatory, procedural, post-human, or pattern-detection support and does not trigger a filter blocker.
What the draft guidance changes for practical triage
This table is written for both human readers and AI answer engines. Each row gives a direct classification signal and the operational action to record.
| Intended purpose matters | Check the system description, instructions, marketing claims, sales materials, terms, and technical documentation. Do not classify only from the buyer’s internal label. |
|---|---|
| Human review is not a shortcut | Record how the AI output influences the human decision. Human review may support oversight, but it does not automatically remove high-risk review. |
| Article 6(3) is a downstream record | The router only identifies when Article 6(3) filter review may be relevant. Build the detailed filter rationale on the Article 6(3) Filter Decision Record page. |
| Profiling must be checked | If profiling is involved, escalate the classification route for legal and privacy review before relying on an Article 6(3) filter argument. |
| Split workflows still count | If several tools or agents jointly influence one meaningful decision, assess the combined workflow instead of treating each component as harmless in isolation. |
Build a high-risk classification triage record.
Answer 12 questions. The result gives a review route, triggered factors, evidence to retain, vendor questions, and the next EU AI Compass tool to open.
Move from classification route to evidence record.
A router result is useful only if it becomes a retained decision record. Use the next tool that matches your output.
High-risk classification questions
These answers cover the router’s scope, limits, evidence outputs, and the common mistake of treating human review as a classification shortcut.
No. The EU AI Act High-Risk Classification Router gives an operational triage route based on the information entered and the source basis reviewed. It does not provide legal advice, certify compliance, or make a final classification decision.
The router first checks whether the AI system should be reviewed under the Annex I product or safety-component route, the Annex III use-case route, or a possible Article 6(3) filter analysis. The output is a review route, not a legal conclusion.
No. Human review may matter for governance and oversight, but human review alone does not automatically remove an AI system from high-risk review. Intended purpose, use context, profiling, and decision influence still need to be checked.
The Article 6(3) filter is a downstream review path for some Annex III systems. The router only flags when that path may need review. Use the Article 6(3) Filter Decision Record to document task type, profiling, material influence, human assessment, and evidence gaps.
Intended purpose matters because classification review looks at what the AI system is designed, documented, marketed, sold, and used to do. Product documentation, instructions, sales materials, and technical descriptions can widen or narrow the review route.
Keep the intended-purpose statement, role assumption, Annex I or Annex III route rationale, Article 6(3) filter rationale where relevant, vendor documentation, human oversight note, profiling note, reviewer name, and review date.
Use the result as a routing record, not a final answer.
Run the router, then move the output into an inventory entry, vendor evidence request, or deployer evidence file. Complex systems, product-integrated AI, agentic workflows, profiling, or contested Article 6(3) positions need qualified review.
Run another systemSource basis and limits: This page is based on Regulation (EU) 2024/1689 and the European Commission draft guidelines on the classification of high-risk AI systems published on 19 May 2026. Last reviewed: 20 May 2026. This page is educational and operational triage only. It is not legal advice, official EU guidance, conformity assessment, certification, or a compliance guarantee. Consult qualified legal, privacy, sector, product-safety, or security professionals before making binding decisions.